Unforgeable Signatures and Coin Flipping on the Phone Martin Tompa Computer Science amp Engineering University of Washington Secret Codes Unforgeable Signatures and Coin Flipping on the Phone ID: 253217
Download Presentation The PPT/PDF document "Secret Codes" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Slide1
Secret Codes
,
Unforgeable Signatures
,
and
Coin Flipping on the Phone
Martin Tompa
Computer Science & Engineering
University of WashingtonSlide2
Secret Codes
,
Unforgeable Signatures,
and
Coin Flipping on the PhoneSlide3
What Is a Cryptosystem?
A
Sender
B
Receiver
Cryptanalyst
(bad guy)
C = E
AB
(M)
M = DAB(C)
M
M C K
AB
Message Encryption KeyPlaintext CyphertextCleartext
K
AB
K
ABSlide4
What Is a
Public Key
Cryptosystem?
A
Sender
B
Receiver
Cryptanalyst
(bad guy)
C = E
AB(M)
M = DAB(C)
M
M C
KB E
BMessage Encryption Private Key Public KeyPlaintext Cyphertext
Cleartext
K
AB
K
ABSlide5
The
RSA
Public Key Cryptosystem
Invented by
R
ivest, Shamir, and Adleman in 1977.Has proven resistant to cryptanalytic attacks.Slide6
Receiver’s Set-Up
Choose 500-digit primes
p
and
q
, with p 2 (mod 3) and q 2 (mod 3)p = 5, q = 11Let n = pq.
n = 55Let s = (1/3) (2(p - 1)(q - 1) + 1).s = (1/3) (2 4 10 + 1) = 27Publish n.Keep p, q, and
s secret.Slide7
Note on the Version Presented Here
I have simplified RSA to make it clearer.
The version presented here is not considered secure, because of the small exponent 3 used in encryption. See
http://crypto.stanford.edu/~dabo/pubs/papers/RSA-survey.pdf
, Section 4.2, first two paragraphs for an explanation of the vulnerability of small exponents.
See Rosen’s textbook for the secure version of RSA.Thanks to Dimitrios Gklezakos for pointing out this vulnerability to me.Slide8
Encrypting a Message
Break the message into chunks.
H I C H R I S …
Translate each chunk into an integer
M
(0 < M < n) by any convenient method.8 9 3 8 18 9 19 …Let E(M) = M3 mod n. M =
8, n = 5583 = 512 = 9×55 + 17E(8) = 17Slide9
Decrypting a Cyphertext C
Let
D(C)
=
C
s mod n.C = 17, n = 55, s = 271727 = 1,667,711,322,168,688,287,513,535,727,415,473
= 30,322,024,039,430,696,136,609,740,498,463 × 55 + 8D(17) = 8Translate D(C) into letters.HSlide10
Decrypting a Cyphertext C
Efficiently
C =
17,
n =
55, s = 27172 289 14 (mod 55)174
172 172 14 14 196 31 (mod 55)
178 174 174 31 31 961
26 (mod 55)1716
178 178 26 26 676 16 (mod 55)
1727 1716 178 172 171 16
26 14 17 416 14 17 31 14 17
434 17
(-6) 17
-102 8 (mod 55)D(17) = 8Slide11
Why Does It Work?
Euler’s Theorem
(1736): Suppose
p
and
q are distinct primes, n = pq, 0 < M < n, and k > 0.Then Mk(p
-1)(q-1)+1 mod n = M. (M3)s = (M3) (1/3)(2(
p-1)(q-1)+1) = M 2(p-1)(q-1)+1 M (mod n)Slide12
Leonhard Euler 1707-1783Slide13
Why Is It Secure?
To find
M
=
D(C)
, you seem to need s.To find s, you seem to need p and q.All the cryptanalyst has is n = pq.How hard is it to factor a 1000-digit number n?
With the grade school method, doing 1,000,000,000,000 steps per second it would take … 10480 years.Slide14
State of the Art in Factoring
1977
: Inventors encrypt a challenge using “RSA129,” a 129-digit number
n
= pq.1981: Pomerance invents Quadratic Sieve factoring method.1994: Using Quadratic Sieve, RSA129 is factored over 8 months using 1000 computers on the Internet around the world.1999: Using Number Field Sieve, RSA140 is factored over one month using 200 computers, about 8.9 CPU-years.2009: Using Number Field Sieve, RSA-768, a 232-digit number, is factored over two years using hundreds of machines, about 1500 CPU-years.Slide15
Secret Codes,
Unforgeable Signatures
,
and
Coin Flipping on the PhoneSlide16
Signed Messages
How A sends a
secret
message to B
A B C = EB(M) M = DB(C)How A sends a signed
message to B A B C = DA(M) M = EA(C)
C
CSlide17
Signed
and
Secret Messages
How A sends a secret message to B ...
A B C = EB(M) M = DB(C)How A sends a signed secret message to B ... A B C =
EB(DA(M)) M = EA (DB(C))
C
CSlide18
Secret Codes,
Unforgeable Signatures,
and
Coin Flipping on the PhoneSlide19
Flipping a Coin Over the Phone
A B
Choose
random
x < x < y = EA
(x) Guess if x is even or odd. Check y = EA(x).
B wins if the guess about x was right, or y = EA(x).
y
“even”
“odd”
x